Government hackers breached telecom giant Ribbon for months before getting caught

US telecommunications giant Ribbon has confirmed that government-backed hackers accessed its network for about a year before being caught, according to a public filing.

The telco giant said in a 10-Q disclosure with the US Securities and Exchange Commission last week that a suspected “nation-state actor gained access to the company’s IT network” in early December 2024. Ribbon said it has notified law enforcement and that it believes the hackers are no longer on its network.

The Texas-headquartered Ribbon Company provides phone, networking and Internet services to enterprises and critical infrastructure companies, such as energy and transportation systems. The company counts hundreds of companies as customers, including Fortune 500 firms and government agencies, such as the Department of Defense.

Reuters Report the first breach.

Catherine Berthier, a spokeswoman for Ribbon, confirmed that three Ribbon customers were known to be affected but declined to name the affected companies, citing confidentiality.

It’s unclear whether the hackers took personally identifiable information from any individuals or other sensitive information in the breach, but the company noted in the filing that “several customer files stored outside the main network on two laptops appear to have been accessed by the threat actor.” Ribon said it has notified affected customers.

Ribbon is the latest in a series of telecommunications providers hacked over the past two years but did not immediately blame a specific government for the hack when asked by TechCrunch.

Berthier declined to provide additional information when asked by TechCrunch, citing the company’s ongoing investigation.

Chinese-backed hackers have been targeted and compromised before At least 200 US-based companiesIn an attempt to steal phone records and calling data of senior US officials, including phone and internet providers. Several telcos have been confirmed to have been hacked as part of the campaign, including AT&T, Verizon and Lumen. Cloud giants and datacenter providers.

Some companies were located outside the United States, including Canada.

Hackers known as Salt Typhoon One of the few hacking groups backed by China The US and its allies are said to be targeting Taiwan as part of a multi-year effort to counter an anticipated future Chinese invasion. According to US government officials.

Ribbon has been updated with comments.